- Email: [email protected]
Cryptographic techniques of strategic data splitting and secure information management
Pervasive and Mobile Computing (
)
–
Contents lists available at ScienceDirect
Pervasive and Mobile Computing journal homepage: www.elsevier.com/locate/pmc
Cryptographic techniques of strategic data splitting and secure information management Lidia Ogiela AGH University of Science and Technology, Cryptography and Cognitive Informatics Research Group, 30 Mickiewicza Ave., PL-30-059 Krakow, Poland
article
info
Article history: Received 29 September 2014 Received in revised form 3 March 2015 Accepted 8 May 2015 Available online xxxx Keywords: Data splitting protocols Secure information management systems Cognitive information systems
abstract This publication presents techniques for classifying strategic information, namely financial figures which make it possible to determine the standing of an enterprise or an organisation. These techniques of classifying (hiding) strategic information will be presented based on their application to problems of securely storing data of special significance, i.e. cryptographic information sharing protocols. What will be innovative will be the use of cryptographic information sharing protocols in cognitive systems for data analysis. This class of systems will be discussed based on systems for the semantic analysis of ratio data used to analyse liquidity indicators. © 2015 Elsevier B.V. All rights reserved.
1. Introduction Information classification in processes of its secure storage and analysis is a task aimed at securing information from being disclosed to unauthorised persons. A person is unauthorised if they should not know the contents of the hidden information, but also if their knowledge of this information at the time is unimportant or insignificant for the person. This is because the information may be immaterial at the moment, but after some time may become significant and then its use could constitute a threat. Securing information from disclosure is a cryptographic problem that has been studied for many years. Both the cryptographic theory and practice support an unambiguous claim that the problems of effectively securing data from disclosure have become the basis of the most important applications developed by this science [1–3]. The subject of confidential or top secret data security has been developed for many years. At the beginning it was thought that cryptographic algorithms are secure if the appropriate (understood as secure) key is used to encrypt and/or decrypt the information. However, it was later noted that just using a secure key is not sufficient, if only because this key might be stolen by unauthorised persons. This is why the most important job was to restrict access to classified sets of information/data as effectively as possible [4–8]. The effectiveness of the solutions applied is not influenced by the types of datasets analysed, so there is a variety of classified data which differs in the contents of this data/information [9–11], the size of the hidden data and of entire sets, and also the form of the analysed information/datasets, i.e. numerical datasets, visual images, signals and sounds, etc. Originally, basic cryptographic techniques, including the processes of coding, encrypting and securing access to data, were considered to be effective for classifying data (Fig. 1). The security of implemented solutions was guaranteed until their weaknesses were identified and these solutions were broken for the first time. This was the way in which new, more effective and more secure algorithms were implemented,
E-mail address: [email protected]. http://dx.doi.org/10.1016/j.pmcj.2015.05.007 1574-1192/© 2015 Elsevier B.V. All rights reserved.
2
L. Ogiela / Pervasive and Mobile Computing (
)
–
Fig. 1. Techniques for protecting information from being obtained by unauthorised persons or from being disclosed.
which eventually also turned out not to be fully secure. Each of the solutions implemented at a specific time was demonstrated to be secure as long as the used cryptographic keys were guaranteed not be broken or stolen by unauthorised individuals. If the key which secured the hidden information from disclosure was stolen, the entire dataset was declassified and the information was revealed. A group of algorithms considered safer and used for more effectively protecting data from disclosure includes information/data sharing algorithms. Data sharing algorithms are based on coding datasets into a binary form and then splitting this coded data among a selected group of secret trustees, each of whom receives one share of the split secret. The method of distributing the split information between protocol participants is determined by the selected cryptographic algorithm. To reconstruct the split information, the approval of all protocol participants is required, as is the combination of all shares of the split secret aimed at reconstructing the split information. After the information is reconstructed, there follows a process of decrypting the information from the binary form to the input format. Data sharing protocols imply the necessity of complete compliance in information reconstruction processes. If this compliance is missing, it is impossible to reconstruct the split information. Cryptographic protocols which ensure that information can be reconstructed with the participation of selected secret trustees are classified to the group of data sharing protocols. In this group of algorithms, the coded information is split between all protocol participants, but reconstructing it requires combining a selected number of secret shares. The number of secret shares necessary to reconstruct the information is selected when the algorithm is defined. Processes for securing data from disclosure have been described earlier, taking into account various ways of analysing data and different uses of information protection methods. Publications [12,13] discussed techniques for securing data in video surveillance systems with the aim of ensuring data confidentiality. Studies [5,14,15,10], in turn, presented information classification techniques in financial data management systems. This publication, however, will give a detailed presentation of cryptographic algorithms for data splitting and sharing dedicated to strategic information/data classification in enterprise/organisation management processes. In addition, processes of managing shared strategic data will be discussed with particular emphasis on running such processes in cognitive data analysis systems. This class of systems will form the basis for interpreting cognitive systems for financial information management. This study will discuss an UBMLRSS – Understanding Based Management Liquidity Ratios Support System – dedicated to the semantic analysis of values of ratios characterising company liquidity. What is innovative is the use of cryptographic techniques for strategic data splitting and sharing for the purpose of supporting enterprise management processes as well as improving the security of strategic data storage and management based on the applied cryptographic techniques. Another innovation is the use of data sharing algorithms supplemented with techniques for cognitively analysing strategic data in systems for semantically analysing financial data. As a result of executing such types of tasks, the author has proposed systems for the semantic analysis of economic/financial figures, used to classify strategic information about company standing. 2. Data splitting and sharing protocols Cryptographic information splitting and sharing protocols are used to classify information by splitting it and sharing it within a certain group of people (secret trustees). Thus the secret/confidential information is not kept by just one individual, but its security is ensured by more people. This is why data splitting and sharing protocols execute a process of splitting data between the number of secrets trustees defined at an early stage of running the algorithm. A secret trustee may be a person or any participant of the entire process (also a computational machine) to whom one part of the split information is assigned. In information splitting protocols, a participant is assigned one of n secret shares. In contrast, in data sharing protocols, a participant may receive one of n shares of the split secret if traditional data sharing schemes are used or more than one share of the split secrets in complex (advanced) data sharing schemes.
L. Ogiela / Pervasive and Mobile Computing (
)
–
3
Fig. 2. Data splitting algorithm: information splitting, distributing shares of the split information between participants in the secret and the data reproduction stage.
In data splitting and sharing protocols, the information I is split between n protocol participants. Most frequently, each participant receives one of n shares of the split information. Each share of the split information I is useless on its own and gives no knowledge about the content of the entire information I. Thus in the case of a voluntary disclosure or a hostile takeover of a single share of the split secret, the possession of a fragment of information I by third persons does not pose a risk to the entire information/dataset. Secret shares of the split information I are held by secret trustees until the time when it becomes necessary to reconstruct and disclose the classified information I. In data splitting and sharing protocols, the process of reconstructing information I can vary. In secret information sharing protocols, it is necessary to combine all n parts of the split information to reconstruct the split information I. If n − 1 protocol participants undertake to reconstruct the information, then information I will not be reconstructed. Hence, in the case of a data splitting protocol, a total unanimity of all secret trustees is necessary to reconstruct the split information. In data sharing protocols, it is necessary to combine a specific number of shares equal to m ≤ n to reconstruct the shared information I. Thus, any m of secret shares must be combined to reconstruct the shared information I. The definition of the value m which represents the number of secret shares necessary for correctly reconstructing the information is implied by the data sharing scheme used. These protocols are known as (m, n)-threshold schemes, where the value n denotes the number of secret shares into which information I will be split, while the number m represents the number of parts required to reconstruct information I. The data splitting protocol scheme is presented in Fig. 2, while the data sharing protocol scheme—in Fig. 3. In data splitting and sharing protocols, the first stage is to code data into a binary form. Then the data is split between n protocol participants. In information splitting protocols, at the stage of information reconstruction it is necessary to combine all shares distributed between secrets trustees. In contrast, in information sharing protocols it is required to combine a selected number of shares deposited with secrets trustees. In processes of securely and efficiently managing information, it is better to use information sharing protocols because in this type of algorithms, the total unanimity at the stage of information reconstruction is not required [5,16]. If such unanimity were missing in a data splitting protocol, it would paralyse enterprise management.
4
L. Ogiela / Pervasive and Mobile Computing (
)
–
Fig. 3. Data sharing algorithm: information division, distributing shares of the divided information between participants in the secret and the data reproduction stage.
Data sharing protocols make it possible to reconstruct the secret or confidential information I without the need for all protocol participants and secret holders to take part. Even if some secret trustees are excluded, the shared message can still be reproduced unlike in a data splitting algorithm, where it cannot be. The accidental or intentional theft of a share of the secret, and the resultant threat that the contents of confidential information I will be disclosed, can lead to information being revealed in data splitting protocols. In a similar situation, if data sharing protocols are used, it is possible to exclude the suspect or untrusted person from the information recreation process. In data management processes run on information management systems, it is better and more flexible to use data sharing protocols [17,9]. 3. Managing shared strategic data At enterprises or organisations, processes of managing information that is secret/confidential or restricted are most frequently identified with processes of strategic data management. In contrast, strategic data management relates to processes of managing datasets which are significant for the development and success of the company. The management processes for this kind of data are executed by a certain group of people who have access rights to secret/strategic datasets and who ensure the complete security of information they possess. Due to its significance, strategic data is an example of data of a secret/confidential nature or restricted (in terms of accessibility) and for this reason is not available to wider groups of recipients. Processes supporting secret data management are exposed to attacks aimed at stealing strategic data, gaining access to it, taking it over and disclosing its contents and meaning to third parties. The security against this type of an authorised external action is provided by cryptographic algorithms for secret information sharing. Information sharing algorithms execute any split of data between n participants of the protocol. Information sharing protocols are implemented using algorithms including the following [14,11,1–3]:
L. Ogiela / Pervasive and Mobile Computing (
• • • • •
)
–
5
Shamir’s algorithm, Lagrange’s interpolation polynomial algorithm, Blake’s vector algorithm, Karnin–Greene–Hellman algorithm, Asmuth–Bloom algorithm.
Cryptographic information sharing protocols operate based on (m, n)-threshold schemes. These schemes split information I into n equal shares of which it is enough to combine any m to reconstruct the split information I. The shared secret can consist of any dataset, and in particular this dataset can contain strategic information/data. This is the nature of economic, financial, commercial information kept by enterprises, which is of particular importance for the development of the company. This kind of data can include e.g. financial figures, enterprise operating strategies, but also intelligence about competitive markets, design data or logistical information. The subject of this study is to analyse economic/financial figures of an enterprise by analysing the value of selected sets of financial ratios. This type of analysis has a significant impact on the definition of future plans of the enterprise and also on launching a new product, on the comprehensive marketing policy or the development of a competitive strategy etc. This analysis will be applied to selected values of economic/financial indicators—numerical data. This type of data is known to selected groups of people in specific managerial groups, in which an efficient process for managing this data has a direct impact on the correct operation and the growth of the enterprise. Processes ensuring the security of systems for managing this type of data are they key purpose for which enterprise strategic information management processes are executed and supported. Algorithms for managing strategic enterprise data and schemes for splitting this type of data between selected groups of information trustees are supported by processes of the secure and effective management of confidential data. At the same time, these processes depend on:
• the enterprise type and the nature of its operations, • the organisation type and its internal structure, • the need to secure the data and its confidentiality degree. The method of splitting strategic information and the effective management of shared data are not influenced by:
• the size of the enterprise/organisation, • the financial standing of the organisation/enterprise, • the business sector in which the enterprise/organisation operates. The algorithm for splitting strategic information I into n shares and distributing them between a selected group of secret trustees depends on the type of organisation or enterprise structure [5,18]. The most frequently used division is into hierarchical and layered structures [5,18]. Hierarchical structures determine the method of sharing data relative to individual levels of the hierarchy present in a given unit (Fig. 4). In hierarchical structures, data sharing processes are executed independently at individual hierarchy levels. However, the processes of reconstructing shared information are performed by protocol users at higher hierarchical levels. Fig. 4 shows the information split for a hierarchical structure at three different levels. The strategic information I has been coded, and then split into secret shares depending on the hierarchical level. This information can be reconstructed only by protocol participants of a higher level. This is why at the top level of the structure – top management – the split information can be personally reconstructed by the company manager. At a lower level of the hierarchy, the shared secret is reconstructed by any two of three protocol participants—an example of a (2, 3)-threshold scheme. In a layered structure (Fig. 5) the protocols for sharing information I are executed independently in each layer. Information I is coded and then split between n protocol participants. However, reconstructing the split information I requires combining a defined number of shares in particular layers. Fig. 5 presents the sharing protocol for information I in a layered structure. Information I is coded into a binary form and then split into n parts. In the superior layer, information I is individually reconstructed by the company manager. In the subordinate layer, a (2, 3)-threshold scheme is presented, which means that information I will be reconstructed by combining any two secret shares from among three secret trustees. In the lowest layer, a (4, 6)-threshold split is presented, which means that any 4 out of 6 parts of the shared secret must be combined to reconstruct information I. In every layer, the method of classifying information I is similar. Information I is coded into a binary form for the purpose of securing the contents of the data which will be shared. The coded information I is split between n secret trustees. The shares of the secret are distributed in particular layers according to (m, n)-threshold schemes. To reconstruct the shared information I it is necessary to combine m selected secret shares. For individual layers, the value of m is different. After the required number of shares are combined and information I is reconstructed, it is decoded to its original form, the same as on the protocol input. Processes of securing secret/confidential or restricted information in information sharing protocols are as follows:
• • • •
coding data into a binary form, splitting a secret into shares and distributing them between protocol participants, fewer shares than the number defined in the protocol being useless, the ability to eliminate an unreliable secret trustee from the protocol.
6
L. Ogiela / Pervasive and Mobile Computing (
)
–
Fig. 4. Data sharing protocol in a hierarchical arrangement.
4. Dividing strategic data in cognitive systems In this study, data sharing protocols are dedicated to securing financial data and supporting processes of managing strategic enterprise data. These tasks are executed based on analysing economic and financial data. The author has proposed various classes of semantic data interpretation and cognitive analysis systems for analysing economic and financial figures, and this makes it possible to execute processes of reasoning about the economic and financial standing of the enterprise [5]. Four classes of cognitive systems for the semantic analysis of financial data have been distinguished (Fig. 6). Regardless of the type of analysed economic/financial data, is possible to share the strategic data and distribute it within a selected group of trustees of the split secret. An example of executing the process of sharing financial information is presented below. The Understanding Based Management Liquidity Ratios Support System (UBMLRSS), which analyses company liquidity, has been chosen for this analysis. Information about company liquidity is of major significance not only for that enterprise but
L. Ogiela / Pervasive and Mobile Computing (
)
–
7
Fig. 5. Data sharing protocol in a layered arrangement.
Fig. 6. The classes of cognitive analysis systems for the semantic analysis of financial data. Source: [5].
also for the entire competitive market. Revealing that an enterprise is losing liquidity can cause competitors to take action to make the enterprise go bankrupt. In order to semantically interpret [19,20] the analysed datasets, a formal definition [21–23] of a sequential grammar has been proposed [5]: GL = (VNL , VTL , PL , SL ) where: VNL = {LIQUIDITY, EXCESS_LIQUIDITY, OPTIMAL_LIQUIDITY, SOLVENCY_PROBLEMS}—the set of non-terminal symbols, VTL = {a, b, c, d, e}, where: a ∈ [0; 1), b ∈ [1; 1, 2], c ∈ (1, 2; 1, 5), d ∈ [1, 5; 2], e ∈ (2; +∞)—the set of terminal symbols, SL ∈ VNL , SL = LIQUIDITY, PL —set of productions (Table 1). A grammatical formalism thus defined allows three basic degrees of enterprise liquidity to be distinguished:
8
L. Ogiela / Pervasive and Mobile Computing (
)
–
Table 1 Set of production in GL grammar. Source: [5]. Economic situation
Grammatical rules
Excess liquidity
1. 2.
EXCESS_LIQUIDITY → EEE | EDE | EED
Optimal liquidity
3.
LIQUIDITY → EXCESS_LIQUIDITY | OPTIMAL_LIQUIDITY | SOLVENCY_PROBLEMS
4.
OPTIMAL_LIQUIDITY → DCA | DCB | DBB | DBC | DBA | CBA | CCA | CBD
5.
LIQUIDITY → EXCESS_LIQUIDITY | OPTIMAL_LIQUIDITY | SOLVENCY_PROBLEMS
Solvency problems
LIQUIDITY → EXCESS_LIQUIDITY | OPTIMAL_LIQUIDITY | SOLVENCY_PROBLEMS
Semantic action Liquidity=excess liquidity Liquidity=optimal liquidity Liquidity=solvency problems
6. SOLVENCY_PROBLEMS → DEE | AAA | ABA | AAB | ABB | BAB | BBA | ABC | BAC | ACB | BCA | AAC | ACA | CAA | AAD | ADA | DAA | AAE | AEA | EAA | ACD | ADC | ABD | ADB | DAB | ABE | AEB | BAA | BAD | BAE | BEA | EAB | EBA | CAB | ACC | CAC | BCC | CAD | CDA | CAE | CEA | ACE | ADE | AED | DAE | DEA | EAD | EDA | BBB | CCC | DDD | BBC | CBB | BDA | BCB | BBD | BDB | BBE | BEB | EBB | CCD | CDC | DCC | CCE | CEC | ECC | DDE | DED | EDD | BCD | BDC | CDB | BCE | BEC | ECB | EBC | CBE | CEB | CDE | CED | EDC | ECD | DEC | DCE | EEA | EAE | AEE | EEB | EBE | BEE | CEE | ECE | EEC | DDA | DAD | ADD | BDD | DBD | DDB | DDC | CDD | DCD | BDE | BED | CBC | CCB | DAC | DBE | EAC | EBD | ECA | EDB | AEC | DEB Lesion features
7.
A→a
8. 9. 10. 11.
B→b C→c D→d E→e
Lesion features=values of the indicator, frequency
• excessive liquidity, • optimum liquidity, • liquidity problems. Every situation related to company liquidity that can occur at an enterprise is identified by analysing the value of liquidity ratios of this enterprise. The general condition of the enterprise, its causes, related recommendations, the method of improving the current situation etc. can be of a strategic nature and can thus have the character of confidential information. In this case, this data is classified due to its limited accessibility for third persons. Processes of strategic information sharing are executed depending on the type of structure in which the data is classified. A data sharing process for a hierarchical structure is presented in Fig. 7. Fig. 7 shows the results produced by an UBMLRSS system which has identified the condition of the enterprise by analysing liquidity ratios—the current ratio, quick ratio and cash ratio. A semantic analysis of selected liquidity ratios of the enterprise allowed its general condition to be defined and indicated that the enterprise has problems with staying liquid. As a result, the UBMLRSS system has indicated the enterprise problems and difficulties with paying all mature liabilities on time. This situation of the enterprise, which is strategically significant for its future, particularly because of the competitors’ activity, has become the basis for using information classification protocols including the data sharing protocol. At the next stage, the data is coded and then the information sharing protocol is used to split it within a hierarchical arrangement between secret trustees. The secret was split into six shares and then individual secrets shares were allocated to protocol participants. This split was made in such a way that at the lowest hierarchy level these shares were divided between six protocol participants, and any four of these secrets shares must be combined to reconstruct the information: a (4, 6)-threshold scheme. At a higher level, the data was split between three protocol participants (each participant holds two secret shares from the split at the subordinate level) and any two of them can reconstruct the shared secret. After the secret is reconstructed, the information is decoded, and finally we obtained information about the condition of the enterprise. An example of the operation of a UBMLRSS system and a strategic data sharing protocol for a layered structure are presented in Fig. 8. Fig. 8 shows the results produced by an UBMLRSS system which has identified the condition of the enterprise based on liquidity ratios—the current ratio, quick ratio and cash ratio. The situation of the enterprise, just as in the previous example from Fig. 7, which is strategically significant for the company’s future, has become the basis for using information classification protocols, including a data sharing protocol. The data is coded and then the information sharing protocol is used to split it within a hierarchical arrangement between secret trustees. The secret was split into six shares and then individual secret shares were allocated to protocol participants. This split was made in such a way that in the lowest layer, these shares were divided between six protocol participants, and any four of these secrets shares must be combined to reconstruct the information: a (4, 6)-threshold scheme. In contrast, in the superior layer, this data was split between three protocol participants of whom any two can reconstruct the shared secret. The information is reconstructed independently in each layer according to the specified (m, n)-threshold scheme. After the secret is reconstructed, the information is decoded, and finally we obtained information about the condition of the enterprise.
L. Ogiela / Pervasive and Mobile Computing (
)
–
9
Fig. 7. Example of strategic data sharing in cognitive systems—a hierarchical structure.
The presented examples of protocols for sharing strategic information obtained from cognitive financial data analysis systems demonstrate the way in which data is split, distributed between protocol participants, classified and secured. Strategic data management processes which make use of data sharing protocols to ensure data security and confidentiality allow the following:
10
L. Ogiela / Pervasive and Mobile Computing (
)
–
Fig. 8. Example of strategic data sharing in cognitive systems—a layered structure.
• • • •
secure storage of strategic data, restricted access to secret information, efficient management of secret information of the enterprise/organisation, eliminating unreliable persons from the stage of shared information reconstruction.
The ability to exclude an unreliable person at the stage of information I reconstruction is based on the use of threshold schemes in the entire information sharing process. If any group of secret trustees suspects that another trustee is acting to
L. Ogiela / Pervasive and Mobile Computing (
)
–
11
the detriment of the remaining protocol participants or could use the secret information for unintended purposes, then this group of secret trustees can avoid selecting the unreliable trustee in the information reconstruction process. This way this trustee will be excluded from the process of declassifying information, and will thus not know its contents. 5. Conclusions Managing information that is strategic, of particular importance, confidential/secret or restricted requires ensuring the complete confidentiality and security of the datasets stored. Data security has to be ensured at every stage of its storage, in the processes of its analysis, processing, management and transmission (transfer) between system users. Security can be ensured by using data splitting and sharing algorithms. In strategic information management processes it is better to use data sharing protocols because of their greater flexibility and the ability to modify the solutions used. Cryptographic protocols based on executing threshold data sharing schemes ensure the security of the shared information, the split of the secret between probable participants as specified at the stage of algorithm definition and the improvement of management processes by applying them to semantic data analysis algorithms. The semantic analysis used in the interpretation of economic/financial data based on a ratio analysis allows the current condition of the enterprise to be assessed and reasoned about. Based on the completed analysis, various information is obtained, both less important and information of strategic significance for the enterprise. Confidential and secret data is protected from unauthorised access and theft. If this kind of data is stored by a single person, there is a risk that it will be used only according to the intentions of this individual. However, if this data concerns an enterprise led by a group of people and managed by a certain group (not just by a single person), then secret and strategic data can be split among a group of secret trustees. This solution ensures data security, its use in accordance with the majority’s intention and the effective management of the enterprise by eliminating significant decision-taking by a selected person or a group of persons. Secret information can be effectively stored by a selected group of secret trustees among whom it has been split. Just the fact that protocol participants hold a part of the confidential information (the secret) does not entitle the holder to learn the contents of the secret. This is because it is necessary to obtain the selected number of secret shares to reconstruct the shared information. This method of securing strategic information means that the information is not kept as one whole, which would expose the enterprise to the risk of this data being lost, disclosed or used against the enterprise if the information were stolen, if the system were broken into or if the information were received under false pretences. Sharing information between appointed secret trustees and allocating individual secret shares to given trustees makes it possible to manage secret information in a secure way. In addition, it enables this information to be securely stored and sent without the risk that the loss of one share would cause the entire secret information to be declassified. Acknowledgements This work has been supported by the National Science Centre, Republic of Poland, under project number DEC2013/09/B/HS4/00501. References [1] [2] [3] [4] [5] [6]
[7] [8] [9] [10] [11] [12]
[13] [14] [15] [16] [17] [18]
B. Schneier, Applied Cryptography: Protocols, Algorithms, and Source Code in C, Wiley, 1996. A. Shamir, How to share a secret, Commun. ACM (1979) 612–613. S. Tang, Simple secret sharing and threshold RSA signature schemes, J. Inf. Comput. Sci. 1 (2004) 259–262. T. Hachaj, M.R. Ogiela, Visualization of perfusion abnormalities with GPU-based volume rendering, Comput. Graph. UK 36 (3) (2012) 163–169. L. Ogiela, Data management in cognitive financial systems, Int. J. Inf. Manage. 33 (2013) 263–270. L. Ogiela, M.R. Ogiela, Semantic analysis processes in advanced pattern understanding systems, in: T-h. Kim, H. Adeli, R.J. Robles, M. Balitanas (Eds.), Advanced Computer Science and Information Technology, in: Comunications in Computer and Information Science, vol. 195, Springer-Verlag, Berlin, Heidelberg, 2011, pp. 26–30. L. Ogiela, M.R. Ogiela, Cognitive systems and bio-inspired computing in homeland security, J. Netw. Comput. Appl. 38 (2014) 34–42. M.R. Ogiela, U. Ogiela, Linguistic protocols for secure information management and sharing, Comput. Math. Appl. 63 (2) (2012) 564–572. Elsevier. K.C. Laudon, J.P. Laudon, Management Information Systems—Managing the Digital Firm, seventh ed., Prentice-Hall International Inc., 2002. L. Ogiela, M.R. Ogiela, Advences in Cognitive Information Systems, in: COSMOS, vol. 17, Springer-Verlag, Berlin, Heidelberg, 2012. M.R. Ogiela, U. Ogiela, The use of mathematical linguistic methods in creating secret sharing threshold algorithms, Comput. Math. Appl. 60 (2) (2010) 267–271. Elsevier. A. Castiglione, M. Cepparulo, A. De Santis, F. Palmieri, Towards a lawfully secure and privacy preserving video surveillance system, in: F. Buccafurri, G. Semeraro (Eds.), E-Commerce and Web Technologies, 11th International Conference, EC-Web 2010, Bilbao, Spain, September 1–3, 2010, in: Lecture Notes in Business Information Processing, vol. 61, 2010, pp. 73–84. A. Castiglione, A. De Santis, F. Palmieri, Ensuring privacy and confidentiality in digital video surveillance systems, in: George O.M. Yee (Ed.), Privacy Protection Measures and Technologies in Business Organizations: Aspects and Standards, IGI Global, 2012, pp. 245–267. L. Ogiela, Toward cognitive economy, in: Soft Computing, Vol. 18(9), Springer-Verlag, Heidelberg, 2014, pp. 1675–1683. L. Ogiela, M.R. Ogiela, Cognitive systems for intelligent business information management in cognitive economy, Int. J. Inf. Manage. 34 (6) (2014) 751–760. Elsevier. L. Ogiela, Semantic analysis and biological modeling in selected classes of cognitive information systems, Math. Comput. Modelling 58 (2013) 1405–1414. L. Bernstein, J. Wild, Analysis of Financial Statements, fifth ed., Amazon, 1999. M.R. Ogiela, U. Ogiela, Security of linguistic threshold schemes in multimedia systems, in: E. Damiani, J. Jeong, R.J. Howlett, L.C. Jain (Eds.), New Directions in Intelligent Interactive Multimedia Systems and Services - 2, in: Studies in Computational Intelligence, vol. 226, Springe-Verlag, Berlin, Heidelberg, 2009, pp. 13–20.
12
L. Ogiela / Pervasive and Mobile Computing (
)
–
[19] L. Ogiela, Syntactic approach to cognitive interpretation of medical patterns, in: Caihua Xiong, et al. (Eds.), Intelligent Robotics and Applications, Springer-Verlag, Berlin, Heidelberg, 2008, pp. 456–462. [20] L. Ogiela, Cognitive informatics in image semantics description, identification and automatic pattern understanding, Neurocomputing 122 (2013) 58–69. [21] M.R. Ogiela, S. Bodzioch, Computer analysis of gallbladder ultrasonic images towards recognition of pathological lesions, Opto-Electron. Rev. 19 (2) (2011) 155–168. [22] S. Grossberg, Adaptive resonance theory: How a brain learns to consciously attend, learn, and recognize a changing world, Neural Netw. 37 (2012) 1–47. [23] T. Hachaj, M.R. Ogiela, Application of neural networks in detection of abnormal brain perfusion regions, Neurocomputing 122 (2013) 33–42.
)
–
Contents lists available at ScienceDirect
Pervasive and Mobile Computing journal homepage: www.elsevier.com/locate/pmc
Cryptographic techniques of strategic data splitting and secure information management Lidia Ogiela AGH University of Science and Technology, Cryptography and Cognitive Informatics Research Group, 30 Mickiewicza Ave., PL-30-059 Krakow, Poland
article
info
Article history: Received 29 September 2014 Received in revised form 3 March 2015 Accepted 8 May 2015 Available online xxxx Keywords: Data splitting protocols Secure information management systems Cognitive information systems
abstract This publication presents techniques for classifying strategic information, namely financial figures which make it possible to determine the standing of an enterprise or an organisation. These techniques of classifying (hiding) strategic information will be presented based on their application to problems of securely storing data of special significance, i.e. cryptographic information sharing protocols. What will be innovative will be the use of cryptographic information sharing protocols in cognitive systems for data analysis. This class of systems will be discussed based on systems for the semantic analysis of ratio data used to analyse liquidity indicators. © 2015 Elsevier B.V. All rights reserved.
1. Introduction Information classification in processes of its secure storage and analysis is a task aimed at securing information from being disclosed to unauthorised persons. A person is unauthorised if they should not know the contents of the hidden information, but also if their knowledge of this information at the time is unimportant or insignificant for the person. This is because the information may be immaterial at the moment, but after some time may become significant and then its use could constitute a threat. Securing information from disclosure is a cryptographic problem that has been studied for many years. Both the cryptographic theory and practice support an unambiguous claim that the problems of effectively securing data from disclosure have become the basis of the most important applications developed by this science [1–3]. The subject of confidential or top secret data security has been developed for many years. At the beginning it was thought that cryptographic algorithms are secure if the appropriate (understood as secure) key is used to encrypt and/or decrypt the information. However, it was later noted that just using a secure key is not sufficient, if only because this key might be stolen by unauthorised persons. This is why the most important job was to restrict access to classified sets of information/data as effectively as possible [4–8]. The effectiveness of the solutions applied is not influenced by the types of datasets analysed, so there is a variety of classified data which differs in the contents of this data/information [9–11], the size of the hidden data and of entire sets, and also the form of the analysed information/datasets, i.e. numerical datasets, visual images, signals and sounds, etc. Originally, basic cryptographic techniques, including the processes of coding, encrypting and securing access to data, were considered to be effective for classifying data (Fig. 1). The security of implemented solutions was guaranteed until their weaknesses were identified and these solutions were broken for the first time. This was the way in which new, more effective and more secure algorithms were implemented,
E-mail address: [email protected]. http://dx.doi.org/10.1016/j.pmcj.2015.05.007 1574-1192/© 2015 Elsevier B.V. All rights reserved.
2
L. Ogiela / Pervasive and Mobile Computing (
)
–
Fig. 1. Techniques for protecting information from being obtained by unauthorised persons or from being disclosed.
which eventually also turned out not to be fully secure. Each of the solutions implemented at a specific time was demonstrated to be secure as long as the used cryptographic keys were guaranteed not be broken or stolen by unauthorised individuals. If the key which secured the hidden information from disclosure was stolen, the entire dataset was declassified and the information was revealed. A group of algorithms considered safer and used for more effectively protecting data from disclosure includes information/data sharing algorithms. Data sharing algorithms are based on coding datasets into a binary form and then splitting this coded data among a selected group of secret trustees, each of whom receives one share of the split secret. The method of distributing the split information between protocol participants is determined by the selected cryptographic algorithm. To reconstruct the split information, the approval of all protocol participants is required, as is the combination of all shares of the split secret aimed at reconstructing the split information. After the information is reconstructed, there follows a process of decrypting the information from the binary form to the input format. Data sharing protocols imply the necessity of complete compliance in information reconstruction processes. If this compliance is missing, it is impossible to reconstruct the split information. Cryptographic protocols which ensure that information can be reconstructed with the participation of selected secret trustees are classified to the group of data sharing protocols. In this group of algorithms, the coded information is split between all protocol participants, but reconstructing it requires combining a selected number of secret shares. The number of secret shares necessary to reconstruct the information is selected when the algorithm is defined. Processes for securing data from disclosure have been described earlier, taking into account various ways of analysing data and different uses of information protection methods. Publications [12,13] discussed techniques for securing data in video surveillance systems with the aim of ensuring data confidentiality. Studies [5,14,15,10], in turn, presented information classification techniques in financial data management systems. This publication, however, will give a detailed presentation of cryptographic algorithms for data splitting and sharing dedicated to strategic information/data classification in enterprise/organisation management processes. In addition, processes of managing shared strategic data will be discussed with particular emphasis on running such processes in cognitive data analysis systems. This class of systems will form the basis for interpreting cognitive systems for financial information management. This study will discuss an UBMLRSS – Understanding Based Management Liquidity Ratios Support System – dedicated to the semantic analysis of values of ratios characterising company liquidity. What is innovative is the use of cryptographic techniques for strategic data splitting and sharing for the purpose of supporting enterprise management processes as well as improving the security of strategic data storage and management based on the applied cryptographic techniques. Another innovation is the use of data sharing algorithms supplemented with techniques for cognitively analysing strategic data in systems for semantically analysing financial data. As a result of executing such types of tasks, the author has proposed systems for the semantic analysis of economic/financial figures, used to classify strategic information about company standing. 2. Data splitting and sharing protocols Cryptographic information splitting and sharing protocols are used to classify information by splitting it and sharing it within a certain group of people (secret trustees). Thus the secret/confidential information is not kept by just one individual, but its security is ensured by more people. This is why data splitting and sharing protocols execute a process of splitting data between the number of secrets trustees defined at an early stage of running the algorithm. A secret trustee may be a person or any participant of the entire process (also a computational machine) to whom one part of the split information is assigned. In information splitting protocols, a participant is assigned one of n secret shares. In contrast, in data sharing protocols, a participant may receive one of n shares of the split secret if traditional data sharing schemes are used or more than one share of the split secrets in complex (advanced) data sharing schemes.
L. Ogiela / Pervasive and Mobile Computing (
)
–
3
Fig. 2. Data splitting algorithm: information splitting, distributing shares of the split information between participants in the secret and the data reproduction stage.
In data splitting and sharing protocols, the information I is split between n protocol participants. Most frequently, each participant receives one of n shares of the split information. Each share of the split information I is useless on its own and gives no knowledge about the content of the entire information I. Thus in the case of a voluntary disclosure or a hostile takeover of a single share of the split secret, the possession of a fragment of information I by third persons does not pose a risk to the entire information/dataset. Secret shares of the split information I are held by secret trustees until the time when it becomes necessary to reconstruct and disclose the classified information I. In data splitting and sharing protocols, the process of reconstructing information I can vary. In secret information sharing protocols, it is necessary to combine all n parts of the split information to reconstruct the split information I. If n − 1 protocol participants undertake to reconstruct the information, then information I will not be reconstructed. Hence, in the case of a data splitting protocol, a total unanimity of all secret trustees is necessary to reconstruct the split information. In data sharing protocols, it is necessary to combine a specific number of shares equal to m ≤ n to reconstruct the shared information I. Thus, any m of secret shares must be combined to reconstruct the shared information I. The definition of the value m which represents the number of secret shares necessary for correctly reconstructing the information is implied by the data sharing scheme used. These protocols are known as (m, n)-threshold schemes, where the value n denotes the number of secret shares into which information I will be split, while the number m represents the number of parts required to reconstruct information I. The data splitting protocol scheme is presented in Fig. 2, while the data sharing protocol scheme—in Fig. 3. In data splitting and sharing protocols, the first stage is to code data into a binary form. Then the data is split between n protocol participants. In information splitting protocols, at the stage of information reconstruction it is necessary to combine all shares distributed between secrets trustees. In contrast, in information sharing protocols it is required to combine a selected number of shares deposited with secrets trustees. In processes of securely and efficiently managing information, it is better to use information sharing protocols because in this type of algorithms, the total unanimity at the stage of information reconstruction is not required [5,16]. If such unanimity were missing in a data splitting protocol, it would paralyse enterprise management.
4
L. Ogiela / Pervasive and Mobile Computing (
)
–
Fig. 3. Data sharing algorithm: information division, distributing shares of the divided information between participants in the secret and the data reproduction stage.
Data sharing protocols make it possible to reconstruct the secret or confidential information I without the need for all protocol participants and secret holders to take part. Even if some secret trustees are excluded, the shared message can still be reproduced unlike in a data splitting algorithm, where it cannot be. The accidental or intentional theft of a share of the secret, and the resultant threat that the contents of confidential information I will be disclosed, can lead to information being revealed in data splitting protocols. In a similar situation, if data sharing protocols are used, it is possible to exclude the suspect or untrusted person from the information recreation process. In data management processes run on information management systems, it is better and more flexible to use data sharing protocols [17,9]. 3. Managing shared strategic data At enterprises or organisations, processes of managing information that is secret/confidential or restricted are most frequently identified with processes of strategic data management. In contrast, strategic data management relates to processes of managing datasets which are significant for the development and success of the company. The management processes for this kind of data are executed by a certain group of people who have access rights to secret/strategic datasets and who ensure the complete security of information they possess. Due to its significance, strategic data is an example of data of a secret/confidential nature or restricted (in terms of accessibility) and for this reason is not available to wider groups of recipients. Processes supporting secret data management are exposed to attacks aimed at stealing strategic data, gaining access to it, taking it over and disclosing its contents and meaning to third parties. The security against this type of an authorised external action is provided by cryptographic algorithms for secret information sharing. Information sharing algorithms execute any split of data between n participants of the protocol. Information sharing protocols are implemented using algorithms including the following [14,11,1–3]:
L. Ogiela / Pervasive and Mobile Computing (
• • • • •
)
–
5
Shamir’s algorithm, Lagrange’s interpolation polynomial algorithm, Blake’s vector algorithm, Karnin–Greene–Hellman algorithm, Asmuth–Bloom algorithm.
Cryptographic information sharing protocols operate based on (m, n)-threshold schemes. These schemes split information I into n equal shares of which it is enough to combine any m to reconstruct the split information I. The shared secret can consist of any dataset, and in particular this dataset can contain strategic information/data. This is the nature of economic, financial, commercial information kept by enterprises, which is of particular importance for the development of the company. This kind of data can include e.g. financial figures, enterprise operating strategies, but also intelligence about competitive markets, design data or logistical information. The subject of this study is to analyse economic/financial figures of an enterprise by analysing the value of selected sets of financial ratios. This type of analysis has a significant impact on the definition of future plans of the enterprise and also on launching a new product, on the comprehensive marketing policy or the development of a competitive strategy etc. This analysis will be applied to selected values of economic/financial indicators—numerical data. This type of data is known to selected groups of people in specific managerial groups, in which an efficient process for managing this data has a direct impact on the correct operation and the growth of the enterprise. Processes ensuring the security of systems for managing this type of data are they key purpose for which enterprise strategic information management processes are executed and supported. Algorithms for managing strategic enterprise data and schemes for splitting this type of data between selected groups of information trustees are supported by processes of the secure and effective management of confidential data. At the same time, these processes depend on:
• the enterprise type and the nature of its operations, • the organisation type and its internal structure, • the need to secure the data and its confidentiality degree. The method of splitting strategic information and the effective management of shared data are not influenced by:
• the size of the enterprise/organisation, • the financial standing of the organisation/enterprise, • the business sector in which the enterprise/organisation operates. The algorithm for splitting strategic information I into n shares and distributing them between a selected group of secret trustees depends on the type of organisation or enterprise structure [5,18]. The most frequently used division is into hierarchical and layered structures [5,18]. Hierarchical structures determine the method of sharing data relative to individual levels of the hierarchy present in a given unit (Fig. 4). In hierarchical structures, data sharing processes are executed independently at individual hierarchy levels. However, the processes of reconstructing shared information are performed by protocol users at higher hierarchical levels. Fig. 4 shows the information split for a hierarchical structure at three different levels. The strategic information I has been coded, and then split into secret shares depending on the hierarchical level. This information can be reconstructed only by protocol participants of a higher level. This is why at the top level of the structure – top management – the split information can be personally reconstructed by the company manager. At a lower level of the hierarchy, the shared secret is reconstructed by any two of three protocol participants—an example of a (2, 3)-threshold scheme. In a layered structure (Fig. 5) the protocols for sharing information I are executed independently in each layer. Information I is coded and then split between n protocol participants. However, reconstructing the split information I requires combining a defined number of shares in particular layers. Fig. 5 presents the sharing protocol for information I in a layered structure. Information I is coded into a binary form and then split into n parts. In the superior layer, information I is individually reconstructed by the company manager. In the subordinate layer, a (2, 3)-threshold scheme is presented, which means that information I will be reconstructed by combining any two secret shares from among three secret trustees. In the lowest layer, a (4, 6)-threshold split is presented, which means that any 4 out of 6 parts of the shared secret must be combined to reconstruct information I. In every layer, the method of classifying information I is similar. Information I is coded into a binary form for the purpose of securing the contents of the data which will be shared. The coded information I is split between n secret trustees. The shares of the secret are distributed in particular layers according to (m, n)-threshold schemes. To reconstruct the shared information I it is necessary to combine m selected secret shares. For individual layers, the value of m is different. After the required number of shares are combined and information I is reconstructed, it is decoded to its original form, the same as on the protocol input. Processes of securing secret/confidential or restricted information in information sharing protocols are as follows:
• • • •
coding data into a binary form, splitting a secret into shares and distributing them between protocol participants, fewer shares than the number defined in the protocol being useless, the ability to eliminate an unreliable secret trustee from the protocol.
6
L. Ogiela / Pervasive and Mobile Computing (
)
–
Fig. 4. Data sharing protocol in a hierarchical arrangement.
4. Dividing strategic data in cognitive systems In this study, data sharing protocols are dedicated to securing financial data and supporting processes of managing strategic enterprise data. These tasks are executed based on analysing economic and financial data. The author has proposed various classes of semantic data interpretation and cognitive analysis systems for analysing economic and financial figures, and this makes it possible to execute processes of reasoning about the economic and financial standing of the enterprise [5]. Four classes of cognitive systems for the semantic analysis of financial data have been distinguished (Fig. 6). Regardless of the type of analysed economic/financial data, is possible to share the strategic data and distribute it within a selected group of trustees of the split secret. An example of executing the process of sharing financial information is presented below. The Understanding Based Management Liquidity Ratios Support System (UBMLRSS), which analyses company liquidity, has been chosen for this analysis. Information about company liquidity is of major significance not only for that enterprise but
L. Ogiela / Pervasive and Mobile Computing (
)
–
7
Fig. 5. Data sharing protocol in a layered arrangement.
Fig. 6. The classes of cognitive analysis systems for the semantic analysis of financial data. Source: [5].
also for the entire competitive market. Revealing that an enterprise is losing liquidity can cause competitors to take action to make the enterprise go bankrupt. In order to semantically interpret [19,20] the analysed datasets, a formal definition [21–23] of a sequential grammar has been proposed [5]: GL = (VNL , VTL , PL , SL ) where: VNL = {LIQUIDITY, EXCESS_LIQUIDITY, OPTIMAL_LIQUIDITY, SOLVENCY_PROBLEMS}—the set of non-terminal symbols, VTL = {a, b, c, d, e}, where: a ∈ [0; 1), b ∈ [1; 1, 2], c ∈ (1, 2; 1, 5), d ∈ [1, 5; 2], e ∈ (2; +∞)—the set of terminal symbols, SL ∈ VNL , SL = LIQUIDITY, PL —set of productions (Table 1). A grammatical formalism thus defined allows three basic degrees of enterprise liquidity to be distinguished:
8
L. Ogiela / Pervasive and Mobile Computing (
)
–
Table 1 Set of production in GL grammar. Source: [5]. Economic situation
Grammatical rules
Excess liquidity
1. 2.
EXCESS_LIQUIDITY → EEE | EDE | EED
Optimal liquidity
3.
LIQUIDITY → EXCESS_LIQUIDITY | OPTIMAL_LIQUIDITY | SOLVENCY_PROBLEMS
4.
OPTIMAL_LIQUIDITY → DCA | DCB | DBB | DBC | DBA | CBA | CCA | CBD
5.
LIQUIDITY → EXCESS_LIQUIDITY | OPTIMAL_LIQUIDITY | SOLVENCY_PROBLEMS
Solvency problems
LIQUIDITY → EXCESS_LIQUIDITY | OPTIMAL_LIQUIDITY | SOLVENCY_PROBLEMS
Semantic action Liquidity=excess liquidity Liquidity=optimal liquidity Liquidity=solvency problems
6. SOLVENCY_PROBLEMS → DEE | AAA | ABA | AAB | ABB | BAB | BBA | ABC | BAC | ACB | BCA | AAC | ACA | CAA | AAD | ADA | DAA | AAE | AEA | EAA | ACD | ADC | ABD | ADB | DAB | ABE | AEB | BAA | BAD | BAE | BEA | EAB | EBA | CAB | ACC | CAC | BCC | CAD | CDA | CAE | CEA | ACE | ADE | AED | DAE | DEA | EAD | EDA | BBB | CCC | DDD | BBC | CBB | BDA | BCB | BBD | BDB | BBE | BEB | EBB | CCD | CDC | DCC | CCE | CEC | ECC | DDE | DED | EDD | BCD | BDC | CDB | BCE | BEC | ECB | EBC | CBE | CEB | CDE | CED | EDC | ECD | DEC | DCE | EEA | EAE | AEE | EEB | EBE | BEE | CEE | ECE | EEC | DDA | DAD | ADD | BDD | DBD | DDB | DDC | CDD | DCD | BDE | BED | CBC | CCB | DAC | DBE | EAC | EBD | ECA | EDB | AEC | DEB Lesion features
7.
A→a
8. 9. 10. 11.
B→b C→c D→d E→e
Lesion features=values of the indicator, frequency
• excessive liquidity, • optimum liquidity, • liquidity problems. Every situation related to company liquidity that can occur at an enterprise is identified by analysing the value of liquidity ratios of this enterprise. The general condition of the enterprise, its causes, related recommendations, the method of improving the current situation etc. can be of a strategic nature and can thus have the character of confidential information. In this case, this data is classified due to its limited accessibility for third persons. Processes of strategic information sharing are executed depending on the type of structure in which the data is classified. A data sharing process for a hierarchical structure is presented in Fig. 7. Fig. 7 shows the results produced by an UBMLRSS system which has identified the condition of the enterprise by analysing liquidity ratios—the current ratio, quick ratio and cash ratio. A semantic analysis of selected liquidity ratios of the enterprise allowed its general condition to be defined and indicated that the enterprise has problems with staying liquid. As a result, the UBMLRSS system has indicated the enterprise problems and difficulties with paying all mature liabilities on time. This situation of the enterprise, which is strategically significant for its future, particularly because of the competitors’ activity, has become the basis for using information classification protocols including the data sharing protocol. At the next stage, the data is coded and then the information sharing protocol is used to split it within a hierarchical arrangement between secret trustees. The secret was split into six shares and then individual secrets shares were allocated to protocol participants. This split was made in such a way that at the lowest hierarchy level these shares were divided between six protocol participants, and any four of these secrets shares must be combined to reconstruct the information: a (4, 6)-threshold scheme. At a higher level, the data was split between three protocol participants (each participant holds two secret shares from the split at the subordinate level) and any two of them can reconstruct the shared secret. After the secret is reconstructed, the information is decoded, and finally we obtained information about the condition of the enterprise. An example of the operation of a UBMLRSS system and a strategic data sharing protocol for a layered structure are presented in Fig. 8. Fig. 8 shows the results produced by an UBMLRSS system which has identified the condition of the enterprise based on liquidity ratios—the current ratio, quick ratio and cash ratio. The situation of the enterprise, just as in the previous example from Fig. 7, which is strategically significant for the company’s future, has become the basis for using information classification protocols, including a data sharing protocol. The data is coded and then the information sharing protocol is used to split it within a hierarchical arrangement between secret trustees. The secret was split into six shares and then individual secret shares were allocated to protocol participants. This split was made in such a way that in the lowest layer, these shares were divided between six protocol participants, and any four of these secrets shares must be combined to reconstruct the information: a (4, 6)-threshold scheme. In contrast, in the superior layer, this data was split between three protocol participants of whom any two can reconstruct the shared secret. The information is reconstructed independently in each layer according to the specified (m, n)-threshold scheme. After the secret is reconstructed, the information is decoded, and finally we obtained information about the condition of the enterprise.
L. Ogiela / Pervasive and Mobile Computing (
)
–
9
Fig. 7. Example of strategic data sharing in cognitive systems—a hierarchical structure.
The presented examples of protocols for sharing strategic information obtained from cognitive financial data analysis systems demonstrate the way in which data is split, distributed between protocol participants, classified and secured. Strategic data management processes which make use of data sharing protocols to ensure data security and confidentiality allow the following:
10
L. Ogiela / Pervasive and Mobile Computing (
)
–
Fig. 8. Example of strategic data sharing in cognitive systems—a layered structure.
• • • •
secure storage of strategic data, restricted access to secret information, efficient management of secret information of the enterprise/organisation, eliminating unreliable persons from the stage of shared information reconstruction.
The ability to exclude an unreliable person at the stage of information I reconstruction is based on the use of threshold schemes in the entire information sharing process. If any group of secret trustees suspects that another trustee is acting to
L. Ogiela / Pervasive and Mobile Computing (
)
–
11
the detriment of the remaining protocol participants or could use the secret information for unintended purposes, then this group of secret trustees can avoid selecting the unreliable trustee in the information reconstruction process. This way this trustee will be excluded from the process of declassifying information, and will thus not know its contents. 5. Conclusions Managing information that is strategic, of particular importance, confidential/secret or restricted requires ensuring the complete confidentiality and security of the datasets stored. Data security has to be ensured at every stage of its storage, in the processes of its analysis, processing, management and transmission (transfer) between system users. Security can be ensured by using data splitting and sharing algorithms. In strategic information management processes it is better to use data sharing protocols because of their greater flexibility and the ability to modify the solutions used. Cryptographic protocols based on executing threshold data sharing schemes ensure the security of the shared information, the split of the secret between probable participants as specified at the stage of algorithm definition and the improvement of management processes by applying them to semantic data analysis algorithms. The semantic analysis used in the interpretation of economic/financial data based on a ratio analysis allows the current condition of the enterprise to be assessed and reasoned about. Based on the completed analysis, various information is obtained, both less important and information of strategic significance for the enterprise. Confidential and secret data is protected from unauthorised access and theft. If this kind of data is stored by a single person, there is a risk that it will be used only according to the intentions of this individual. However, if this data concerns an enterprise led by a group of people and managed by a certain group (not just by a single person), then secret and strategic data can be split among a group of secret trustees. This solution ensures data security, its use in accordance with the majority’s intention and the effective management of the enterprise by eliminating significant decision-taking by a selected person or a group of persons. Secret information can be effectively stored by a selected group of secret trustees among whom it has been split. Just the fact that protocol participants hold a part of the confidential information (the secret) does not entitle the holder to learn the contents of the secret. This is because it is necessary to obtain the selected number of secret shares to reconstruct the shared information. This method of securing strategic information means that the information is not kept as one whole, which would expose the enterprise to the risk of this data being lost, disclosed or used against the enterprise if the information were stolen, if the system were broken into or if the information were received under false pretences. Sharing information between appointed secret trustees and allocating individual secret shares to given trustees makes it possible to manage secret information in a secure way. In addition, it enables this information to be securely stored and sent without the risk that the loss of one share would cause the entire secret information to be declassified. Acknowledgements This work has been supported by the National Science Centre, Republic of Poland, under project number DEC2013/09/B/HS4/00501. References [1] [2] [3] [4] [5] [6]
[7] [8] [9] [10] [11] [12]
[13] [14] [15] [16] [17] [18]
B. Schneier, Applied Cryptography: Protocols, Algorithms, and Source Code in C, Wiley, 1996. A. Shamir, How to share a secret, Commun. ACM (1979) 612–613. S. Tang, Simple secret sharing and threshold RSA signature schemes, J. Inf. Comput. Sci. 1 (2004) 259–262. T. Hachaj, M.R. Ogiela, Visualization of perfusion abnormalities with GPU-based volume rendering, Comput. Graph. UK 36 (3) (2012) 163–169. L. Ogiela, Data management in cognitive financial systems, Int. J. Inf. Manage. 33 (2013) 263–270. L. Ogiela, M.R. Ogiela, Semantic analysis processes in advanced pattern understanding systems, in: T-h. Kim, H. Adeli, R.J. Robles, M. Balitanas (Eds.), Advanced Computer Science and Information Technology, in: Comunications in Computer and Information Science, vol. 195, Springer-Verlag, Berlin, Heidelberg, 2011, pp. 26–30. L. Ogiela, M.R. Ogiela, Cognitive systems and bio-inspired computing in homeland security, J. Netw. Comput. Appl. 38 (2014) 34–42. M.R. Ogiela, U. Ogiela, Linguistic protocols for secure information management and sharing, Comput. Math. Appl. 63 (2) (2012) 564–572. Elsevier. K.C. Laudon, J.P. Laudon, Management Information Systems—Managing the Digital Firm, seventh ed., Prentice-Hall International Inc., 2002. L. Ogiela, M.R. Ogiela, Advences in Cognitive Information Systems, in: COSMOS, vol. 17, Springer-Verlag, Berlin, Heidelberg, 2012. M.R. Ogiela, U. Ogiela, The use of mathematical linguistic methods in creating secret sharing threshold algorithms, Comput. Math. Appl. 60 (2) (2010) 267–271. Elsevier. A. Castiglione, M. Cepparulo, A. De Santis, F. Palmieri, Towards a lawfully secure and privacy preserving video surveillance system, in: F. Buccafurri, G. Semeraro (Eds.), E-Commerce and Web Technologies, 11th International Conference, EC-Web 2010, Bilbao, Spain, September 1–3, 2010, in: Lecture Notes in Business Information Processing, vol. 61, 2010, pp. 73–84. A. Castiglione, A. De Santis, F. Palmieri, Ensuring privacy and confidentiality in digital video surveillance systems, in: George O.M. Yee (Ed.), Privacy Protection Measures and Technologies in Business Organizations: Aspects and Standards, IGI Global, 2012, pp. 245–267. L. Ogiela, Toward cognitive economy, in: Soft Computing, Vol. 18(9), Springer-Verlag, Heidelberg, 2014, pp. 1675–1683. L. Ogiela, M.R. Ogiela, Cognitive systems for intelligent business information management in cognitive economy, Int. J. Inf. Manage. 34 (6) (2014) 751–760. Elsevier. L. Ogiela, Semantic analysis and biological modeling in selected classes of cognitive information systems, Math. Comput. Modelling 58 (2013) 1405–1414. L. Bernstein, J. Wild, Analysis of Financial Statements, fifth ed., Amazon, 1999. M.R. Ogiela, U. Ogiela, Security of linguistic threshold schemes in multimedia systems, in: E. Damiani, J. Jeong, R.J. Howlett, L.C. Jain (Eds.), New Directions in Intelligent Interactive Multimedia Systems and Services - 2, in: Studies in Computational Intelligence, vol. 226, Springe-Verlag, Berlin, Heidelberg, 2009, pp. 13–20.
12
L. Ogiela / Pervasive and Mobile Computing (
)
–
[19] L. Ogiela, Syntactic approach to cognitive interpretation of medical patterns, in: Caihua Xiong, et al. (Eds.), Intelligent Robotics and Applications, Springer-Verlag, Berlin, Heidelberg, 2008, pp. 456–462. [20] L. Ogiela, Cognitive informatics in image semantics description, identification and automatic pattern understanding, Neurocomputing 122 (2013) 58–69. [21] M.R. Ogiela, S. Bodzioch, Computer analysis of gallbladder ultrasonic images towards recognition of pathological lesions, Opto-Electron. Rev. 19 (2) (2011) 155–168. [22] S. Grossberg, Adaptive resonance theory: How a brain learns to consciously attend, learn, and recognize a changing world, Neural Netw. 37 (2012) 1–47. [23] T. Hachaj, M.R. Ogiela, Application of neural networks in detection of abnormal brain perfusion regions, Neurocomputing 122 (2013) 33–42.